Crypto theft rises 55% to $1.18 billion in third quarter

Hacken recorded $1.18 billion in crypto theft from July through September, a 55% increase from the second quarter, according to its Oct. 15 report. The number of incidents rose to 107 from 67.

The average recorded loss per incident fell slightly to about $11 million from roughly $11.4 million. The higher quarterly total therefore resulted from the increase in incidents.

Hacken’s second-quarter report listed $763.9 million in losses, with 88.3% attributed to compromised keys, signers and infrastructure. That amounted to about $675 million. The third-quarter report used the category “access-control and operational failures,” which represented 40% of losses, or about $472 million.

The reports use different labels, so the figures do not establish an exact quarter-to-quarter growth rate. Smart contract incidents accounted for 48% of third-quarter losses, compared with about 11% in Hacken’s original second-quarter summary. The third-quarter share represents about $566 million, compared with roughly $84 million in the second quarter.

Two September incidents involved separate failures in crypto withdrawal controls. In Bitget’s Sept. 30 investigation update, the exchange attributed its Sept. 24 incident to compromised third-party security products. An Oct. 14 account said attackers obtained high-privilege internal credentials and used them to inject forged withdrawal commands into Bitget’s exchange wallet environment.

Bitget’s investigation ruled out private-key compromise and found that its cold wallets were unaffected. The exchange initially estimated the affected amount at about $351.6 million, then raised it to about $387.5 million after including additional assets. Its final verified figure was approximately $388 million.

Bitget reported that user balances were unaffected and that its Protection Fund would cover the financial impact. Phased withdrawals reopened on Oct. 2.

Liquid’s incident involved invalid assets passing a validation process. Blockstream’s Sept. 23 assessment found that a defect in an Elements range-proof cache allowed about 4,000 unbacked LBTC, or liquid staking tokens, to pass validation. The cache stored results from earlier checks, and a coding error allowed different data arrangements to produce the same input. An invalid proof could therefore reuse a valid result.

SideSwap processed the LBTC conversion into Bitcoin automatically. The platform acknowledged that it had no size, speed or wallet-history checks for the transaction. Online keys and automatic forwarding removed a manual review point. Blockstream found that the peg-out authorization key was not stolen or forged. SideSwap reported that its keys, wallet and systems were not compromised.

Blockstream’s assessment recorded the return of 3,400 BTC on Sept. 7 and about 602 BTC outstanding at the time of the report.

Two incidents at Drift Protocol and KelpDAO accounted for 75.5% of Hacken’s second-quarter losses. Smart contract bugs appeared in 44 of the 67 incidents during that quarter but represented about 11% of the money lost.